A regional hospital enables MACsec on the link between two access switches. An engineer expects the traffic to stay encrypted after it is routed across the core toward a far server. Those core links do not run MACsec. What does this MACsec session protect?
Select an answer to reveal the explanation.
Short Explanation
MACsec is a locked door on one hallway, not an armored truck to the far building. You encrypted only the access link, so after the hospital routes the packet onto a core link with no MACsec session the frames are no longer protected. It is not an IPsec tunnel to the server.
Full Explanation
MACsec, defined by 802.1AE, encrypts Ethernet frames on the link where the session is negotiated. MACsec Key Agreement sets up that session between the two devices on the link. The receiving switch decrypts the frame before it routes the packet, and the next link builds a new frame. If that core link has no MACsec session, the hospital traffic is not protected there. The access-link session does not follow the packet across the routed core. MACsec is not a routed tunnel to a far server. A tunnel that stays encrypted across the core would be a different technology, and enabling MACsec on one access link does not create it. Fibre Channel frames on a VSAN are not encrypted by an Ethernet MACsec session on an access switch. MACsec also does not authenticate CLI users or replace AAA. Caveat: every hop that needs confidentiality needs its own MACsec session, including switch-to-switch links that are easy to forget after the access layer is done. Operational check: confirm the access link shows a secure MACsec session, then confirm the core link does not, and treat anything past the first hop as unprotected until that hop is secured too.